AuthName in .htaccess not displayed in Chrome

user_3754413 0
Viewed 2684

I am trying to secure a website with an .htaccess file with Apache2. It works well but the message specified with the AuthName line is not visible on Chrome (but it is visible on Firefox !). What should I do to make it visible on Chrome?

Here is my .htaccess file

AuthType Basic
AuthName "Restricted Access"
AuthFile "/etc/apache2/.htpasswd"
Require valid-user

On Firefox the pop-up tells

The site ... is requesting your username and password. The site says: "Restricted Access"

But on Chrome it only tells

Sign in

.htaccess apache2
2 Answers

What should I do to make it visible on Chrome?

There is nothing you can do.

The browser decides whether it wants to display this information to the user in some way, or not.

The phrasing used in the Apache documentation already hints at that (highlights by me) -

https://httpd.apache.org/docs/2.4/mod/mod_authn_core.html#authname:

The string provided for the AuthName is what will appear in the password dialog provided by most browsers.

https://httpd.apache.org/docs/2.4/howto/auth.html#gettingitworking:

The AuthName directive sets the Realm to be used in the authentication. The realm serves two major functions. First, the client often presents this information to the user as part of the password dialog box. Second, it is used by the client to determine what password to send for a given authenticated area.

user_14278780

Here is a workaround which can give some info for your unlucky visitor, using custom error document feature after the login attempt fails:

Put this line into your .htaccess file:

ErrorDocument 401 YYYY-MM-DDTHHMM-Site-update-under-way-Estimate-30-min

The continuous text seems to get displayed after login fails or is canceled. No dots (.) or colons (:) allowed. Of course it should represent a valid filename, but if the user has no access to public_html due to login fail a file maybe can't be served anyway. If You can serve a proper 401 error page, You can explain the situation there.

(edit 1) Maybe this behaviour is a curiosity in my case with shared hosting. The shared server there seems to be nginx which I guess "is forced" to accept .htaccess directives.

(edit 2) Confirmed this behaviour also with Apache 2.4 server

user_108271720
Related